mirror of https://github.com/KumoCorp/kumomta.git synced 2026-09-11 16:01:28 +00:00

Files

T

Wez Furlong 4055c50522 authz: introduce an ACL facility

This commit is a step towards some general improvements around
our handling of authentication and authorization.

This commit is focused primarily on authorization, but there are
some adjustments to how we track authentication as part of enabling
that.

We now have a separate AuthInfo type that holds the overall
authentication information/context associated with an inbound
SMTP or HTTP session.

It is populated with the peer_address as a fact rather than a statement
of trust.

If authentication via the appropriate lua auth callback is successful,
then the AuthInfo has additional identities added.

There are some types and events for loading access control lists and
matching their rules against an AuthInfo.

There is now a system default ACL that is equivalent to the prior
hard-coded access policy that was encoded into each HTTP endpoint.

This change makes it possible to replace the ACL with a
user-defined ACL.

Later will be some work on authentication to allow more options
for HTTP auth.

2025-12-18 06:30:06 +00:00

960 B

Raw Blame History

kumo.aaa.set_fall_back_to_acl_map

kumo.on('pre_init', function()
  kumo.aaa.set_fall_back_to_acl_map(true)
end)

This function accepts a single boolean argument that controls whether or not the default ACL map will be used as a fallback source for an ACL definition if the get_acl_definition event doesn't return an ACL.

The default is true.

If you set this to false then your get_acl_definition implementation is considered to the definitive and only source of ACL definitions in your deployment, completely replacing the product default ACL definitions.

!!! note This function is intended to be used in pre_init as shown above. It can be called at any time, but it is recommended that you call it within pre_init and restart the service if you want to change its value, in order for your overall AAA configuration to apply consistently.

960 B Raw Blame History

kumo.aaa.set_fall_back_to_acl_map

960 B

Raw Blame History